INTEGRATED MANAGEMENT SYSTEMS AUDITS: INTERNAL AUDIT TOOL *

Transcription

1 INTEGRATED MANAGEMENT SYSTEMS AUDITS: INTERNAL AUDIT TOOL * Denis Bourcier, Ph.D. VP, Quality and Regulatory Compliance Avchem, Inc St. Louis, MO Co-authors: Larry Tibert EH&S Business Manager National Quality Assurance NQA Acton, MA William Trappen, PE Professor Quality Assurance Program California State University, Dominguez Hills * Source is Author s Thesis Project, MSQA, California State University, Dominquez Hills, 2007; contact D.R. Bourcier for additional information on the audit tool ([email protected]) Podium 112, EHS Management and Training: Lessons Learned and Emerging Trends, American Industrial Hygiene Conference, Philadelphia, PA, June 5, 2007

2 Abstract Internal and External Audit Process for Integrated Quality, Environmental, and Safety Management Systems Authors: D. Bourcier*, Avchem, Inc, Kent, WA; L. Tibert, National Quality Assurance, Acton, MA; W. Trappen, Quality Assurance Program, California State University, Dominquez Hills, CA Abstract: The opportunity for industry to take advantage of integration of management systems has never been timelier. The International Organization for Standardization (ISO) with the release of 14001:2004 has taken steps to ensure that it aligns with the 9001:2000 standard. The recent release of the ANSI Z10 OHS Mgt System Standard in the US and the growing acceptance of the OHSAS has initiated greater emphasis on standards integration as well as combined audits. Common elements and language makes both implementation and auditing easier than in the past. The purpose of the present study was to develop plans for third-party auditing as well as internal audits of an organization registered to the three standards with added components being 1) the registration to the aerospace version of the ISO 9001:2000, the AS9100, Rev. B for a chemical management services company and 2) the requirement to develop a multi-site audit plan. The project was undertaken by both the registrar and the organization audited in developing the third-party audit and internal audit program, respectively. With regard to the third-party registration process, the registrar reviewed all current guidelines for both the development of the multi-site registration plan as well as those for the auditing process itself. A similar process was used by the auditing organization but with more flexibility due to the more limited requirements. Using several examples of components of the multi-site plan as well as the auditing criteria itself, the third-party registrar was able to develop a viable audit process and plan. With respect to the organization s audit process, the implementation of the plan required the integrated quality, environmental and safety management system audit at each of its 13 locations throughout the United States and Canada which complemented internal regulatory audits. The resultant audit checklist included common elements of all three standards. This presentation concentrates on the internal audit tool, the source data to the audit checklist, and checklist Data output. *Denis R. Bourcier, Ph.D, Avchem Inc th Ave. S. Kent, WA [email protected]

3 Background: Multiple Standards Philosophy Many aerospace companies are expanding their coverage of registration beyond the QMS required by the AS9100 Standard (SAE-AAQG) AAQG) ISO is most prevalent among added standards OHSAS Specification is gaining interest, some registrars already have experience performing audits in the UK ANSI Z-10 Z Consensus Std also gaining interest in the US Many drivers for OHSAS in Aerospace Industry: internal initiatives for improvement, contract requirements,, market incentives (it is a discriminator for contracts) Quality Management System is the foundation for additional requirements-- EHSMS is linked to it*

4 The Organization: Integration of Multiple Standard (IMS) Auditing (Multiple Sites), Considerations-- QEHS Professionals are: Integrating common sections of the three standards Linking EHSMS internal audits with internal compliance audit program Developing EHSMS and Quality Manuals/QEHS Policy; Documentation; Objectives, etc This Presentation: Internal audit Tool development for IMS audits: Add ISO 14001/OHSAS requirements to those of the AS9100. Supporting Avchem Multi-site Plan per SAE AIR 5359 for AS9100, specifically a multi-standard audit sampling plan Note: AS9100 requirements form the basis for the program, most stringent

5 Internal Audit Criteria Development- Standards Covered ISO 9001:2000: Quality Management Systems Standard identified here as ISO 9001 (International Organization for Standardization [ISO], 2000). AS9100, Rev. B: the aerospace industry version of the ISO 9001, identified here as AS9100 (SAE International [SAE], 2004). ISO 14001:2004: Environmental Management System Standard (ISO, 2004) identified here as EMS BSI, OHSAS 18001:1999: Occupational Health and Safety Management Systems Specification (British Standards Institution [BSI], 2002a), described here as OHSAS

6 Audit Definitions of Interest : Audit: Systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. Audit Criteria: Set of policies, procedures, or requirements. The criteria are used as a reference against which audit evidence is compared. Audit Evidence: Records, statements of fact, or other information, which are relevant to the audit criteria and verifiable. Audit Findings: Results of the evaluation of the collected audit evidence against audit criteria. Audit findings can indicate either conformity or nonconformity with audit criteria or opportunities for improvement. Audit Conclusion: Outcome of an audit, provided by the audit team after consideration of the audit objectives and all audit findings. Audit Program: : Set of one or more audits planned for a specific time frame and directed towards a specific purpose. An audit program includes all activities necessary for planning, organizing, and conducting g the audits. Audit Plan: Description of the activities and arrangements for an audit. Audit Scope: Extent and boundaries of an audit. The audit scope generally includes a description of the physical locations, organizational units, activities, and processes, as well as the time period covered. Audit Tool (for this application) Method and mechanism of documenting audit criteria, evidence, and findings.

7 Integration of Multiple Standard Auditing at Multiple Sites First : Must understand the big picture QMS, EHSMS

8 Why Develop an Internal Audit Tool (form)? Combine obvious common elements, there are additional elements that can be combined. Many attempts to describe an audit tool in the literature-only deal with common elements-no no product provided. Confusion of audit checklist, list of requirements, findings sheets in the literature with no examples of an audit package The addition of AS9100 audit requirements provided added confusion as these requirements expand those of the ISO 9001 (AS9101 checklist could not be utilized) Industry specificity was needed for CMS, AS9100 Design and Development (Product/service design element-- 7.3) was not required.

9 Internal Audit Criteria Development Objective: Create Audit Tool (form) with the Following Attributes: Combine audit element description, requirements, evidence reviewed, and findings in a single form. Application of the tool must meet all applicable conformance and internal procedural requirements of the audit elements of the applicable standards and associated organizational procedures. Combine key requirements of all four standards (ISO 9001, AS9100, ISO 14001, OHSAS 18001) in a single form. Provide a standardized tool for CMS process that is applicable to corporate as well as off-site plants and the range of activities conducted at those sites. Exclude from audit scope the Design and Development elements of the AS9100 (7.3).

10 Audit Form Attributes (Continued): Exclude from audit scope the review of EHS compliance audit criteria as these are to be handled within a separate and independent audit. Provide a common header and footer for all pages which standardizes the format as well as the audit approach and associated information. The form should be user friendly in that it should be readily understandable by both employees, management, and affected parties. Provide an overview of the standards requirements for each applicable element rather than providing extensive detail, allowing the auditor to consult the standard when reviewing evidence of conformity. Content- Identify additional common elements Examples: Infrastructure (Q-6.3, O-4.4.1, O E-4.4.1) E and Communication (Q-5.5.3, O-4.4.3, O E-4.4.3) E

11 Prior work: Training Agendas, Literature, Software Packages, Agency/organizational literature Several books on IMS: Tricker (2002); Culley (1998); Block and Marsh (2002); Noble (2002) Noble Organizational Mastery with IMS has Appendix with list of questions which could be used on audit checklist Training Agendas beginning to see IMS audit process advertised (Audit Courses) Software electronic electronic media-none for IMS *IRCA Website Newsletter: Integrate for the Future discussed use of integrated audit tool in Singapore with success, no reference to specific tool used. * IRCA (International Registrar of Certified Auditors). Integrate for the future. Retrieved August 5, 2006, from

12 Audit Tool is One of Three Components of the Audit Package Provided to the Customer: Summary Report- Audit overview, scope, results, etc signed off by auditor and auditee The Audit tool (typed): -checklist -evidence data -findings data Internal Corrective Action Request (CAR) form-findings, findings, ref standard and proposed responsibility signed signed by auditor Additional outputs Audit tool hand written draft Evidence collected

13 Description of Audit Tool Elements

14 Audit Tool (form) Components: Header: key audit information including auditor, auditee, date, facility location, Standards audited for conformance, audit control #. Table, Column 1: index number of audit element- used for identification of element in corrective action documentation. Table, Column 2: element number as it appears in the associated standard; O, OHSAS 18001; E, ISO 14001; Q, AS9100. Table, Column 3: auditor initials, used to designated person performing the audit. Table, Column 4: requirement identification, used to state requirement. Table, Column 5: evidence required, listing of typical evidence to review including documentation. Table, Column 6: findings, auditor input including listing of evidence reviewed and findings. Table, Column 7: conformance determination (see table footer), result of evaluation of findings against requirements. Table, footer: applicable standard for which conformance is being evaluated and classification of findings. Page, lower right: page number and total number of pages in the document.

15 IMS Audit Tool--- Results Audit Tool developed for IA use for simultaneous multi-standard audits of CMS (15 pages, can be pages when all audit data entered) Covers Admin activities, customer site-cms, and warehouse processes The current form has 59 rows, each row identifies a specific element of one of the three standards Can include review of past audit findings for CA completion including effectiveness evaluation Does require co-use of standards for reference to requirements

16 Audit Tool and its Conformance to OHSAS Internal Audit Sub-Elements (ref: OHSAS 18001, Section 4.5.4)

17 IMS Audit Tool--- Conclusions Audit Tool successfully and efficiently utilized for internal audits for over 2 years Conforms to requirements of the Audit elements of the various standards It satisfies one of the three prescribed products which are created out of an internal audit Works well for multi-site plan facilities Can use on notepad computer and convert hand-write to text Currently adding Z-10 Z requirements Additional information-see below